Priyal's Tech Blog

Thursday, 25 September 2014

Symmetric encryption without using a key in the C# code

Either symmetric or Asymmetric encryptions, managing keys are a bigger problem than doing the encryption decryption itself. There is a way that we encrypt the data using key in the scope of the machine or user.

Following is the code

// To Encrypt
var textToSecure = "This is the text that we need to secure with encryption";
var textBytes = Encoding.Unicode.GetBytes(textToSecure);
var encryptedText = ProtectedData.Protect(textBytes, null, DataProtectionScope.CurrentUser);
// To Decrypt
var decryptedBytes= ProtectedData.Unprotect(encryptedText, null, DataProtectionScope.CurrentUser);
var decryptedText = Encoding.Unicode.GetString(decryptedBytes);

Note that as the 2nd Param we can pass in an additional byte array as an additional entropy.

Eg : static byte[] s_aditionalEntropy = { 9, 8, 7, 6, 5 };

DataProtectionScope can be either user or Machine. If we select the machine level scope anyone who has the access to the machine can decrypt the encrypted data.

Hashing passwords … How much security we can guarantee ??

There are many ways where we can store application passwords securely. We can use existing frameworks like membership provider in .Net and there are other 3^rd party providers as well. We can use either encryption or hashing in this regard but the most famous way of securing passwords is hashing.

First if all we need to understand that Hashing and Encryption are totally different methods in cryptography. Bit confused eh ? ;) let me explain..

In Encryption what we are doing is we are using one or several keys to do the encryption. So this is called symmetric encryption and normally it is a reversible process.

But Hashing is a one-way process, ie : there is nothing called un-hashing. Hashing using deterministic algorithms. We use our hashing algorithm to create the hash with a the value we need to hash ( password ) and store them. So when we need to do check the value again ( during login process as an example ) the hashing algorithm generates the hash again with given password and check against the saved value.

Normally hashing algorithms are not cracked. Instead, what attackers do is , they are using existing password list and generate hashes and compared vis brute force. We can use tools such as hash cat for this process. Attackers using consumer hardware such as high end GPUs to perform these kind of brute force cracks. If we take an example , the VS2010 membership provider ( default using the SHA1 ) can be cracked up to 60% within 15 mins.

Rainbow tables

Rainbow tables are pre compute hashes where we can use to compare rapidly with breached accounts. Rainbow crack provides pre-configured rainbow tables to download. But these files are huge. As an example , md5_ascii collection for password length 1 to 8 is around 576GB.

How to secure hashing

Technically we cant secure hashing 100% . What we can do is, we can slow down the cracking process hence it is taking much longer time to do the brute force attack on it.

Using Salt

Salt is a sequence of random bytes which got appended with the value ( password ) we need to store securely. So the salt is also saved along with the hashed password. This would eliminate the use of Rainbow tables up to some limit. But if we have a salt rainbow table, still we can use the brute force but would take much longer time to do the cracking.

Using hash algorithms which takes much longer time to compute

VS2012 using the PBKDF2( Password base key derivation function) with HMAC-SHA. This hashing process iterates 1000 times in the crypto.cs class which comes with the VS2010. To compare this with VS2010 method, this takes 10 days( with 1 GPU ) to crack with brute force attack compared to 14 mins in VS2010. But still, it is a matter of time !

Use much stronger hashing algorithms

Instead of using standard hashing algos , we can switch to much stronger hashing algorithms such as BCrypt or Ztetic. Ztetic can be replaced .Net membership provider with some configuration changes. Ztetic using 5000 computations of PBKDF2.

Wednesday, 24 September 2014

Securing ASP.Net configurations from being hacked

ASP.Net configurations are pretty easy to use and highly manageable feature. But this can lead up to many misconfigurations which would lead into high security vulnerabilities.

ELMAH is a handy 3^rd party configuration tool that developers can use to log errors and other information. But bad configuration can be lead up to many loopholes in the security perspective of the application. In following sections I’m explaining how to avoid those misconfigurations.

Handling Errors and redirect properly

First and foremost, we need to enable the customErrors in the web.config file. This is mainly to prevent the yellow screen of death in the browser.

<customErrors mode ="On" defaultRedirect ="Error.aspx"/>

This would solve the YSD issue but it would reveal the error page path in the url section in the browser. To eliminate that, we need to use the redirect mode attribute as below.

<customErrors mode ="On" defaultRedirect ="Error.aspx" redirectMode="ResponseRedirect"/>

This would keep the existing url in the browser’s url section while it is getting redirected to the appropriate error page.

Disable Tracing

Tracing is a handy tool that developers are using to get a log of requests been made and to get information about trace log information.

When you go to the View Details section, you can view various details such as detailed request details, origin .Net framework info etc.. But most dangerously, there can be trace logs that developers have logged and forgot to remove in production code. To remove all these make sure that the following attribute is set to false.

Encrypt config sections

We used to keep sensitive data such as connection string passwords in the web.config file. But leaving these sensitive data in plain text in anywhere is a high security vulnerability. There are many tools and methods where we can encrypt these sections and I’m going to discuss one of the easiest ways we can achieve it using regiis tool.

Run the command prompt in Admin mode

Browse to the .Net framework’s path > eg : C:\Windows\Microsoft.NET\Framework\v4.0.30319

Run the following command
Aspnet_regiis –site “MySecureSite ” –app “/” –pe “ConnectionStrings”

Note : -app is the application folder relative to root of the IIS. In my case I hosted mySecureSite in the root. –pe is the section we need to encrypt

After this you can see the given section is hashed.

Use the –pd attribute in same manner to decrypt the given section.

This may not the most appropriate way to encrypt the config sections but it is fairly easy.

Use config transforms

We can use the Web.Release.Config’s config transform to make sure we are not leaking out any dev related config entries to the production code. Following are two examples of how we can use it.

Following sections would make sure that error mode is remoteonly, the 500 error would redirected to a production error page and the trace attribute is removed.

Keep in mind that in order to take this into the action, we need to publish the web project.

</customErrors>

In the production environment, it is advisable to enable the retail mode in machine.config file.

Saturday, 9 August 2014

Converting MVC 4 Web Application to MVC 5

Most of you guys might have many web applications build on MVC 4 and wanted to take some advantages introduced in the MVC 5. Good news is, you can migrate your MVC 4 application to MVC 5 pretty easily with few configuration changes. The MVC 5 shipped with many cool features to enhance web development using MVC.

Following are the main features that got added or enhanced in MVC 5 and above

ASP.NET Identity
Bootstrap
Authentication filters
Filter overrides
Attribute routing

I am not going to discuss these new features. You can find these new feature enhancements at official ASP.Net site.

Make sure your Target Framework is at least in .Net Framework 4.5 ( or above ) : Go To Project Properties --> Application --> Target Framework :
We need to update following NuGet Packages

Microsoft ASP.Net MVC
Entity Framework
.Net Web API 2

Make sure your packages.config update as follow

<?xml version="1.0" encoding="utf-8"?>

</packages>

Main elements to consider are :

MVC should get update 4 to 5
Razor should get update 2 to 3
WebPages should get update 2 to 3

Next we need to update few references in the root level we.config file as follows

<?xml version="1.0" encoding="utf-8"?>

<!--

For more information on how to configure your ASP.NET application, please visit

http://go.microsoft.com/fwlink/?LinkId=169433

-->

</configSections>

</connectionStrings>

</appSettings>

<system.web>

</authentication>

<pages>

</namespaces>

</pages>

</system.web>

<system.webServer>

</handlers></system.webServer>

</dependentAssembly>

</dependentAssembly>

</dependentAssembly>

</dependentAssembly>

</dependentAssembly>

</dependentAssembly>

</assemblyBinding>

</runtime>

</parameters>

</defaultConnectionFactory>

</providers>

</entityFramework>

</configuration>

Next We need to take a look at the web.config file in the views folder to update Razor configurations.

</sectionGroup>

</configSections>

<system.web.webPages.razor>

</namespaces>

</pages>

</system.web.webPages.razor>

</appSettings>

<system.web>

</httpHandlers>

<!--

Enabling request validation in view pages would cause validation to occur

after the input has already been processed by the controller. By default

MVC performs request validation before a controller processes the input.

To change this behavior apply the ValidateInputAttribute to a

controller or action.

-->

<pages

validateRequest="false"

pageParserFilterType="System.Web.Mvc.ViewTypeParserFilter, System.Web.Mvc, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"

pageBaseType="System.Web.Mvc.ViewPage, System.Web.Mvc, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"

userControlBaseType="System.Web.Mvc.ViewUserControl, System.Web.Mvc, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">

</controls>

</pages>

</system.web>

<system.webServer>

</handlers>

</system.webServer>

</configuration>

Next We need to remove the ASP.Net GUID from the Web Project's .csproj file. The main purpose of this GUID is to identify that particular web project is a MVC web project. But from MVC 5 onwards , this is no longer use. Because there is no specific significance of identifying MVC project as it is. In different words this means, now you can have MVC, Web Forms , Web API ... all combine together in one project.

Remove the highlighted GUID. You need to unload the Web project from the solution and edit the .csproj file. And then reloads the Web project.

<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>

<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>

</ProductVersion>

<OutputType>Library</OutputType>

<AppDesignerFolder>Properties</AppDesignerFolder>

<RootNamespace>MyTestMVC4WebApp</RootNamespace>

<AssemblyName>MyTestMVC4WebApp</AssemblyName>

<MvcBuildViews>false</MvcBuildViews>

</PropertyGroup>